Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 52650: /trunk/ /trunk/epan/dfilter/:

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 17 Oct 2013 17:25:56 -0700
On Oct 17, 2013, at 5:16 PM, Gerald Combs <gerald@xxxxxxxxxxxxx> wrote:

> On 10/16/13 1:02 PM, etxrab@xxxxxxxxxxxxx wrote:
>> http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=52650
>> 
>> User: etxrab
>> Date: 2013/10/16 08:02 PM
>> 
>> Log:
>> Prepend to lists rather than append as that's more efficient.
>> 
>> Directory: /trunk/epan/dfilter/
>>  Changes    Path                 Action
>>  +2 -1      sttype-function.c    Modified
>> 
>> Directory: /trunk/
>>  Changes    Path                   Action
>>  +2 -2      capture-pcap-util.c    Modified
>>  +7 -7      capture_ifinfo.c       Modified
>>  +3 -3      color_filters.c        Modified
> 
> This is causing some weird behavior in places. For example the default
> link-layer header type for Ethernet interfaces is now DOCSIS.

And, given that the typical list of link-layer header types has one entry in it, and the typical entries have between 2 (Ethernet and DOCSIS) and 3 or 4 (for 802.11 with various radio headers, in monitor mode) the performance difference is probably negligible.

I'd say that *all* lists presented to users should be presented in the same order as the data list used to generate the list shown to the user - and if those lists are long enough that the difference between prepending and appending makes a performance difference, that might get lost in the time it takes to show that huge list on the screen, complete with a scrollbar to let the user see all the entries....